🏷️ Orphan Labels Detected (30)

Orphan Labels Detected

Current live reconciliation against the canonical .github/labels.yml file shows 30 repository labels that exist in GitHub but are not defined in the canonical label config.

The previous issue title/body was stale: it reported 96/97 orphan labels and referenced the old .github/automation/labels.yml path. The canonical config path is now .github/labels.yml.

Current Counts

Metric	Count
Repository labels on GitHub	179
Canonical labels in `.github/labels.yml`	149
Canonical labels missing from GitHub	0
Repository labels missing from canonical config	30

Completed So Far

Added type:question and type:support to the canonical issue type model.
Removed unprefixed question and support from the canonical label list.
Added area:labels as a canonical routing label.
Ran label sync in create/update mode. No labels were deleted.
Migrated clear active legacy labels on open issues/PRs:
- test -> type:test
- ci -> area:ci
- blocker -> status:blocked
- documentation -> type:documentation
- maintenance -> type:maintenance
- audit -> type:audit
- a11y -> type:a11y
- security -> type:security
- automation -> type:automation
- dependencies -> area:dependencies
- javascript -> lang:js

Remaining Orphan Labels

a11y
audit
automation
bats
blocker
bug
checklist
ci
comp:help-tabs
configuration
cross-reference
css
dependencies
documentation
github_actions
governance
javascript
js
lang:javascript
maintenance
meta
meta:duplicate
onboarding
package.json
path-resolution
php
quickstart
security
standards
test

Active Labels Needing Maintainer Decision

These remaining orphan labels are still used on open issues and do not have a clear one-to-one canonical target:

bats
checklist
cross-reference
governance
onboarding
path-resolution
quickstart
standards

All other remaining orphan labels appear to be historical-only at the time of the 2026-05-27 audit.

Evidence

Draft PR: fix(labels): reconcile canonical label families #418
Audit report: .github/reports/audits/issue-95-orphan-labels-audit-2026-05-27.md

Close Criteria

Close this issue only after either:

live repository labels exactly match .github/labels.yml; or
maintainers explicitly document accepted repository-specific exceptions for the remaining orphan labels.

🔄 Updated orphan labels list. 97 orphan label(s) currently detected.

Follow-up update (2026-05-27): PR #436 is merged into develop and established the label-governance workstream scaffold. This issue remains OPEN because remediation work is still pending and was not completed by the scaffold PR.

Linked under parent epic #449 ([Epic] Label governance stabilisation and automation hardening). This issue is tracked as the batch-00 triage dependency for the stabilisation workstream.

Execution update (2026-05-27): reran orphan-label triage against current develop.\n\nCurrent state:\n- Repository labels: 180\n- Canonical labels in : 149\n- Canonical labels missing from repo: 0\n- Orphan labels in repo: 31\n\nNet change vs previous audit: orphan count is now 31 (previously 30) because is present as an additional orphan.\n\nCurrent orphan set:\n, , , , , , , , , , , , , , , , , , , , , , , , , , , , Usage: security [-h] [-i] [-l] [-p prompt] [-q] [-v] [command] [opt ...]
-i Run in interactive mode.
-l Run /usr/bin/leaks -nocontext before exiting.
-p Set the prompt to "prompt" (implies -i).
-q Be less verbose.
-v Be more verbose about what's going on.
security commands are:
help Show all commands, or show usage for a command.
list-keychains Display or manipulate the keychain search list.
list-smartcards Display available smartcards.
default-keychain Display or set the default keychain.
login-keychain Display or set the login keychain.
create-keychain Create keychains and add them to the search list.
delete-keychain Delete keychains and remove them from the search list.
lock-keychain Lock the specified keychain.
unlock-keychain Unlock the specified keychain.
set-keychain-settings Set settings for a keychain.
set-keychain-password Set password for a keychain.
show-keychain-info Show the settings for keychain.
dump-keychain Dump the contents of one or more keychains.
create-keypair Create an asymmetric key pair.
add-generic-password Add a generic password item.
add-internet-password Add an internet password item.
add-certificates Add certificates to a keychain.
find-generic-password Find a generic password item.
delete-generic-password Delete a generic password item.
set-generic-password-partition-list Set the partition list of a generic password item.
find-internet-password Find an internet password item.
delete-internet-password Delete an internet password item.
set-internet-password-partition-list Set the partition list of a internet password item.
find-key Find keys in the keychain
set-key-partition-list Set the partition list of a key.
find-certificate Find a certificate item.
find-identity Find an identity (certificate + private key).
delete-certificate Delete a certificate from a keychain.
delete-identity Delete an identity (certificate + private key) from a keychain.
set-identity-preference Set the preferred identity to use for a service.
get-identity-preference Get the preferred identity to use for a service.
create-db Create a db using the DL.
export Export items from a keychain.
import Import items into a keychain.
export-smartcard Export items from a smartcard.
cms Encode or decode CMS messages.
install-mds Install (or re-install) the MDS database.
add-trusted-cert Add trusted certificate(s).
remove-trusted-cert Remove trusted certificate(s).
dump-trust-settings Display contents of trust settings.
user-trust-settings-enable Display or manipulate user-level trust settings.
trust-settings-export Export trust settings.
trust-settings-import Import trust settings.
verify-cert Verify certificate(s).
authorize Perform authorization operations.
authorizationdb Make changes to the authorization policy database.
execute-with-privileges Execute tool with privileges.
leaks Run /usr/bin/leaks on this process.
error Display a descriptive message for the given error code(s).
create-filevaultmaster-keychain Create a keychain containing a key pair for FileVault recovery use.
smartcards Enable, disable or list disabled smartcard tokens.
translocate-policy-check Check whether a path would be translocated.
translocate-status-check Check whether a path is translocated.
translocate-original-path Find the original path for a translocated path.
requirement-evaluate Evaluate a requirement against a cert chain.
filevault Handles FileVault specific settings and overrides.
platformsso Handles Platform SSO specific settings and overrides., , \n\nActive-use check on open work:\n- Open issues scanned: orphan labels in use = 0\n- Open PRs scanned: orphan labels in use = 0\n\nInterpretation:\n- This keeps #95 as the authoritative inventory/remediation tracker.\n- There are no open-item blockers from orphan labels right now, so follow-on work in #66/#67/#69 can proceed while we decide final disposition (delete vs exception list) for the 31 historical/repo-resident orphan labels.\n\nProposed next action in this thread:\n1) Approve an explicit exception list OR\n2) Approve cleanup pass to remove non-canonical orphan labels from the repository label set.

Execution update (2026-05-27) — corrected repost (supersedes malformed shell-expanded comment)

Current state from fresh audit against current develop:

Repository labels: 180
Canonical labels in .github/labels.yml: 149
Canonical labels missing from repo: 0
Orphan labels in repo: 31

Net change vs previous audit:

orphan count is now 31 (previously 30)
new additional orphan observed: codex

Current orphan set:
a11y, audit, automation, bats, blocker, bug, checklist, ci, codex, comp:help-tabs, configuration, cross-reference, css, dependencies, documentation, github_actions, governance, javascript, js, lang:javascript, maintenance, meta, meta:duplicate, onboarding, package.json, path-resolution, php, quickstart, security, standards, test

Active-use check on open work:

Open issues scanned: orphan labels in use = 0
Open PRs scanned: orphan labels in use = 0

Interpretation:

🏷️ Orphan Labels Detected (30) #95 remains the source tracker for final orphan disposition.
No open-item blocker from orphan-label usage right now.
Follow-on execution in [Workflows/Docs] Canonical labels + org seeding workflow #66/[Workflows] Scope README regen to changed paths with concurrency guard #67/[Workflows] Enforce CodeRabbit before Copilot on PRs #69 can proceed in parallel while we finalise delete-vs-exception decisions for these 31 labels.

Proposed next action in this thread:

Approve explicit exception list, or
Approve cleanup pass to remove non-canonical orphan labels from repository label set.

Cross-link update: execution has moved to #66 with first implementation PR now open (#450).\n\n#95 remains the canonical orphan-label disposition tracker; this PR addresses the sync execution gap and workflow hardening needed for downstream remediation.

Live refresh completed on 2026-05-27.\n\nCurrent reconciliation against .github/labels.yml:\n- Repository labels: 180\n- Canonical labels: 149\n- Orphan labels (live minus canonical): 31\n- Canonical missing from repo: 0\n\nNew orphan detected since the earlier draft: .\n\nUpdated audit artefact:\n- \n\nNext decision needed in this issue before execution continues:\n1. Confirm treatment for active ambiguous legacy labels (keep as canonical vs alias/migrate): , , , , , , , , and now if it should remain repo-specific.\n2. Approve whether historical-only orphan labels should be kept for history or removed in a controlled cleanup batch.

Correction: reposting this update cleanly due to shell-escaping noise in the previous comment.

Live refresh completed on 2026-05-27.

Current reconciliation against .github/labels.yml:

Repository labels: 180
Canonical labels: 149
Orphan labels (live minus canonical): 31
Canonical missing from repo: 0

New orphan detected since the earlier draft: codex.

Updated audit artefact:

.github/reports/audits/issue-95-orphan-labels-audit-2026-05-27.md

Next decision needed in this issue before execution continues:

Confirm treatment for active ambiguous legacy labels (keep as canonical vs alias/migrate): bats, checklist, cross-reference, governance, onboarding, path-resolution, quickstart, standards, and codex if it should remain repo-specific.
Approve whether historical-only orphan labels should be kept for history or removed in a controlled cleanup batch.

Execution update: implementation PR is open for this task.\n\n- PR: #452\n- Scope delivered in PR: orphan-label exception policy documented in , and label-sync validation updated to treat policy-protected labels as allowed extras.\n\nWill close #95 after merge confirmation and check pass.

Execution update (corrected repost): implementation PR is open for this task.

PR: feat(workflows): scope README regen and enforce reviewer ordering #452
Scope delivered in PR: orphan-label exception policy documented in .github/label-governance-policy.yml, and label-sync validation updated to treat policy-protected labels as allowed extras.

Will close #95 after merge confirmation and check pass.

Closing as complete. Implemented and merged via PR #452: orphan-label disposition is now explicitly documented in label-governance policy, and label-sync validation treats policy-protected labels as allowed extras.

audit: label-consolidation - Export Linear labels and draft Stage 1 c…

Navigation Menu

Repository navigation

🏷️ Orphan Labels Detected (30) #95